/*

File: report.c

Abstract: Sample log reader using Apple System Logger API.

Version: 1.1

(c) Copyright 2005 Apple Computer, Inc. All rights reserved.

IMPORTANT:  This Apple software is supplied to 

you by Apple Computer, Inc. ("Apple") in 

consideration of your agreement to the following 

terms, and your use, installation, modification 

or redistribution of this Apple software 

constitutes acceptance of these terms.  If you do 

not agree with these terms, please do not use, 

install, modify or redistribute this Apple 

software.

In consideration of your agreement to abide by 

the following terms, and subject to these terms, 

Apple grants you a personal, non-exclusive 

license, under Apple's copyrights in this 

original Apple software (the "Apple Software"), 

to use, reproduce, modify and redistribute the 

Apple Software, with or without modifications, in 

source and/or binary forms; provided that if you 

redistribute the Apple Software in its entirety 

and without modifications, you must retain this 

notice and the following text and disclaimers in 

all such redistributions of the Apple Software. 

Neither the name, trademarks, service marks or 

logos of Apple Computer, Inc. may be used to 

endorse or promote products derived from the 

Apple Software without specific prior written 

permission from Apple.  Except as expressly 

stated in this notice, no other rights or 

licenses, express or implied, are granted by 

Apple herein, including but not limited to any 

patent rights that may be infringed by your 

derivative works or by other works in which the 

Apple Software may be incorporated.

The Apple Software is provided by Apple on an "AS 

IS" basis.  APPLE MAKES NO WARRANTIES, EXPRESS OR 

IMPLIED, INCLUDING WITHOUT LIMITATION THE IMPLIED 

WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY 

AND FITNESS FOR A PARTICULAR PURPOSE, REGARDING 

THE APPLE SOFTWARE OR ITS USE AND OPERATION ALONE 

OR IN COMBINATION WITH YOUR PRODUCTS.

IN NO EVENT SHALL APPLE BE LIABLE FOR ANY 

SPECIAL, INDIRECT, INCIDENTAL OR CONSEQUENTIAL 

DAMAGES (INCLUDING, BUT NOT LIMITED TO, 

PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 

OF USE, DATA, OR PROFITS; OR BUSINESS 

INTERRUPTION) ARISING IN ANY WAY OUT OF THE USE, 

REPRODUCTION, MODIFICATION AND/OR DISTRIBUTION OF 

THE APPLE SOFTWARE, HOWEVER CAUSED AND WHETHER 

UNDER THEORY OF CONTRACT, TORT (INCLUDING 

NEGLIGENCE), STRICT LIABILITY OR OTHERWISE, EVEN 

IF APPLE HAS BEEN ADVISED OF THE POSSIBILITY OF 

SUCH DAMAGE.

*/

/*

 * Example of a report-writing program that searches the ASL

 * data store for messages.

 *

 * This program used the ASL search API to find messages logged by the

 * "SampleD".  The user may specify a maximum log priority

 * and a time interval as command line options.

 * 

 * usage: report [-l max_level] [-s start_offset] [-e end offset]

 * max level must be an integer in the range 0 to 7.

 * start_offset and end_offset are integers that denote a number

 * of hours before the time at which the program is run.  

 *

 * For example, to get a report of all log messages of level 4 (Warning) 

 * or less, in the interval beginning 12 hours ago and ending 6 hours ago:

 *

 * report -l 4 -s 12 -e 6

 *

 * The default for max_level is 5 (Notice).

 * The default start time is 1 hours ago.

 * The default end time is the current time.

 */

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <errno.h>

#include <syslog.h>

#include <asl.h>

#include <unistd.h>

#define PRINT_FMT "%-25s %s\n"

#define DEFAULT_MAX_LEVEL 5

#define DEFAULT_START_TIME_OFFSET 1

#define DEFAULT_END_TIME_OFFSET 0

void

usage()

{

    fprintf(stderr, "usage: report [-l max_level] [-s start_offset] [-e end offset]\n");

    fprintf(stderr, "max level must be an integer in the range 0 to 7.\n");

    fprintf(stderr, "Default is 5.\n");

    fprintf(stderr, "start_offset and end_offset are integers that denote a number\n");

    fprintf(stderr, "of hours before the time at which the program is run.\n");

    fprintf(stderr, "Default start_offset is 1 and end_offset is 0 (i.e. messages in the last hour).\n");

}       

int

main(int argc, char *argv[])

{

    int i, max_level, start_offset, end_offset;

    aslmsg query, msg;

    aslresponse resp;

    char tbuf[11];

        int retval = EXIT_SUCCESS;

    /*

     * Initialize defaults.

     */

    max_level = DEFAULT_MAX_LEVEL;

    start_offset = DEFAULT_START_TIME_OFFSET;

    end_offset = DEFAULT_END_TIME_OFFSET;

    /*

     * Parse command line.

     */

    while ((i = getopt(argc, argv, "l:s:e:")) != -1)

    {

        switch(i)

        {

            case 'l':

                max_level = atoi(optarg);

                if ((max_level < ASL_LEVEL_EMERG) || (max_level > ASL_LEVEL_DEBUG))

                {

                    fprintf(stderr, "Invalid value for max_level.\n");

                    usage();

                    return EXIT_FAILURE;

                }

                break;

            case 's':

                start_offset = atoi(optarg);

                if (start_offset < 0)

                {

                    fprintf(stderr, "Invalid value for start_offset.\n");

                    usage();

                    return EXIT_FAILURE;

                }

                break;

            case 'e':

                end_offset = atoi(optarg);

                if (end_offset < 0)

                {

                    fprintf(stderr, "Invalid value for end_offset.\n");

                    usage();

                    return EXIT_FAILURE;

                }

                break;

        }

    }

    /* 

     * Check that the time interval is at least an hour.

     */

    if (start_offset <= end_offset)

    {

        fprintf(stderr, "Invalid time interval.\n");

        usage();

        return EXIT_FAILURE;

    }

    /*

     * Create a query message.

     */

    query = asl_new(ASL_TYPE_QUERY);

        if (query == NULL)

        {

            fprintf(stderr, "asl_new: unable to allocate query.\n");

            retval = EXIT_FAILURE;

            goto done;

        }

    /* 

         * Set the query's sender to this program.

         * asl_set_query returns 0 on success and -1 on failure

         */

        if ((asl_set_query(query, ASL_KEY_SENDER, "SampleD", ASL_QUERY_OP_EQUAL)) != 0)

        {

            fprintf(stderr, "asl_set_query: unable to set query.\n");

            retval = EXIT_FAILURE;

            goto done;

        }

    /* Level <= max_level */

    snprintf(tbuf, 10, "%d", max_level);

    if ((asl_set_query(query, ASL_KEY_LEVEL, tbuf, ASL_QUERY_OP_LESS_EQUAL | ASL_QUERY_OP_NUMERIC)) != 0)

        {

            fprintf(stderr, "asl_set_query: unable to set query.\n");

            retval = EXIT_FAILURE;

            goto done;

        }

    /* "Remote Host" has a value. */

    if ((asl_set_query(query, "Remote Host", NULL, ASL_QUERY_OP_NOT_EQUAL)) != 0)

        {

            fprintf(stderr, "asl_set_query: unable to set query.\n");

            retval = EXIT_FAILURE;

            goto done;

        }

    /*

     * Start time is minus start_offset hours.

     * minus sign means before the current time, "H" means the offset is in hours.

     */

    snprintf(tbuf, 10, "-%dH", start_offset);

    if ((asl_set_query(query, ASL_KEY_TIME, tbuf, ASL_QUERY_OP_GREATER_EQUAL)) != 0)

        {

            fprintf(stderr, "asl_set_query: unable to set query.\n");

            retval = EXIT_FAILURE;

            goto done;

        }

    if (end_offset > 0)

    {

        /* End time is minus end_offset hours. */

        snprintf(tbuf, 10, "-%dH", end_offset);

        if ((asl_set_query(query, ASL_KEY_TIME, tbuf, ASL_QUERY_OP_LESS_EQUAL)) != 0)

                {

                    fprintf(stderr, "asl_set_query: unable to set query.\n");

                    retval = EXIT_FAILURE;

                    goto done;

                }

    }

    /*

     * Perform the search.

         * asl_search will return 0 if the supplied query is NULL.

         * Otherwise it returns a valid aslresponse, even if there are no matches.

     */

    resp = asl_search(NULL, query);

        if (resp == NULL)

        {

            fprintf(stderr, "asl_search: NULL query.\n");

            retval = EXIT_FAILURE;

            goto done;

        }

    /*

     * Get the first matching message.

     */

    msg = aslresponse_next(resp);

    /*

     * Only print out a report if we have had any connections.

     */

    if (msg != NULL)

    {

        printf("Connection Summary\n");

        printf("==================\n\n");

        printf(PRINT_FMT, "Time", "IP Address");

        do

        {

            const char *tim, *host;

            tim = asl_get(msg, ASL_KEY_TIME);

            host = asl_get(msg, "Remote Host");

            printf(PRINT_FMT, tim, host);

        } while ((msg = aslresponse_next(resp)) != NULL);

    }

    aslresponse_free(resp);

done:

    asl_free(query);

    return retval;

}